Designation of Voluntary Disclosure Reporting Program (VDRP) Information as Protected From Public Disclosure, 54405-54409 [E6-15257]

Agencies

• Federal Aviation Administration
• DEPARTMENT OF TRANSPORTATION

[Federal Register Volume 71, Number 179 (Friday, September 15, 2006)]
[Rules and Regulations]
[Pages 54405-54409]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E6-15257]


-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Part 193


Designation of Voluntary Disclosure Reporting Program (VDRP) 
Information as Protected From Public Disclosure

ACTION: Notice of order.

-----------------------------------------------------------------------

SUMMARY: On August 17, 2006, the Federal Aviation Administration (FAA) 
issued FAA Order 8000.89, Designation of Voluntary Disclosure Reporting 
Program (VDRP) Information as Protected from Public Disclosure under 14 
CFR Part 193. There is a regulatory requirement to print the order in 
its

[[Page 54406]]

entirety in the Federal Register. The entire order follows after the 
subtitle, SUPPLEMENTARY INFORMATION.

DATES: Effective August 17, 2006.

FOR FURTHER INFORMATION CONTACT: Dr. Thomas Longridge, Manager, 
Voluntary Safety Programs, Flight Standards Service; Telephone: (703) 
661-0275; E-mail: thomas.longridge@faa.gov.

SUPPLEMENTARY INFORMATION: 

1. Purpose

    This order designates information received by the agency from a 
Voluntary Disclosure Reporting Program (VDRP) as protected from public 
disclosure in accordance with the provisions of Title 14 of the Code of 
Federal Regulations (14 CFR) part 193.

2. Distribution

    This order is distributed to the branch level in the Washington 
headquarters Flight Standards Service; Aviation System Standards; all 
Regional Administrators; to the Directors of the Mike Monroney 
Aeronautical Center and the Europe, Africa, and Middle East Area 
Office; to the Regulatory Standards Division at the FAA Academy; to the 
branch level in the regional Flight Standards Divisions; to all Flight 
Standards District Offices; to all International and Aeronautical 
Quality Assurance Field Offices; to all Flight Standards Certificate 
Management Offices; and to all Aircraft Evaluation Groups.

3. Background

    Under Title 49 of the United States Code (49 U.S.C.) 40123, certain 
voluntarily provided safety and security information is protected from 
disclosure in order to encourage persons to provide the information to 
the Federal Aviation Administration (FAA). The FAA must first issue an 
order that specifies why the agency finds that the information should 
be protected in accordance with 49 U.S.C. 40123. The FAA's rules for 
implementing that section are in 14 CFR part 193. If the Administrator 
issues an order designating information as protected under 49 U.S.C. 
40123, that information will not be disclosed under the Freedom of 
Information Act (Title 5 of the United States Code (5 U.S.C.) 552) or 
other laws, except as provided in 49 U.S.C. 40123, 14 CFR part 193, and 
the order designating the information as protected. This order is 
issued under part 193, Sec.  193.11, which sets out the notice 
procedure for designating information as protected.

4. Applicability

    This order is applicable to any FAA office that receives 
information covered under this designation from a VDRP. The order also 
is applicable to any other government agency that receives such 
information from the FAA. In order for any other government agency to 
receive VDRP information covered under this designation from the FAA, 
each such agency must first stipulate, in writing, that it will abide 
by the provisions of part 193 and this order.

5. Summary of the VDRP Voluntary Information Sharing Program

    a. Qualified Participants. Regulated entities as provided in 
Advisory Circular (AC) 00-58, as amended, or, for hazardous materials, 
in accordance with AC 121-37, as amended.
    b. Voluntarily Provided Information Protected from Disclosure Under 
This Designation. The content of all submissions by a regulated entity 
that are accepted under the VDRP, including, but not limited to, all of 
the following items:
    (1) Information contained in an initial notification to the FAA:
    (a) A brief description of the apparent violation, including an 
estimate of the duration of time that it remained undetected, as well 
as how and when it was discovered;
    (b) Verification that noncompliance ceased after it was identified;
    (c) A brief description of the immediate action taken after the 
apparent violation was identified, the immediate action taken to 
terminate the conduct that resulted in the apparent violation, and the 
person responsible for taking the immediate action;
    (d) Verification that an evaluation is underway to determine if 
there are any systemic problems;
    (e) Identification of the person responsible for preparing the 
comprehensive fix; and
    (f) Acknowledgment that a detailed written report will be provided 
to the designated FAA official within 10 working days.
    (2) Information contained in a detailed written report:
    (a) A list of the specific FAA regulations that may have been 
violated;
    (b) A description of the apparent violation, including the duration 
of time it remained undetected, as well as how and when it was 
detected;
    (c) A description of the immediate action taken to terminate the 
conduct that resulted in the apparent violation, including when it was 
taken, and who was responsible for taking the action;
    (d) An explanation that shows the apparent violation was 
inadvertent;
    (e) Evidence that demonstrates the seriousness of the apparent 
violation and the regulated entity's analysis of that evidence;
    (f) A detailed description of the proposed comprehensive fix, 
outlining the planned corrective steps, the responsibilities for 
implementing those corrective steps, and a time schedule for completion 
of the fix; and
    (g) Identification of the company official responsible for 
monitoring the implementation and completion of the comprehensive fix.
    (3) FAA generated documentation and electronic information that is 
directly associated with an accepted VDRP submission, including, but 
not limited to:
    (a) Acknowledgement of receipt of a VDRP submission.
    (b) Notification of VDRP acceptance, request for modification, or 
rejection.
    (c) Routine correspondence directly associated with a VDRP 
submission.
    (d) FAA records directly associated with FAA monitoring of a 
comprehensive fix.
    (e) FAA Letter of Correction for an accepted VDRP submission.
    (f) A FAA electronic database of VDRP submissions and FAA 
responses.


    Note: The type of information or circumstances under which the 
information listed above would not be protected from disclosure is 
discussed in paragraph 6e(2) of this order.


    c. Ways to Participate. Regulated entities may participate by 
submitting a voluntary disclosure in accordance with the procedures in 
Advisory Circular 00-58, as amended, or, for hazardous materials, in 
accordance with Advisory Circular 121-37.
    d. Duration of this Information-Sharing Program. This information 
sharing program will continue in effect indefinitely, unless the FAA 
terminates the VDRP, or until the order of designation under 14 CFR 
part 193 for the VDRP is withdrawn by the FAA.

6. Findings

    The FAA designates information received from an accepted VDRP 
submission as protected under 49 U.S.C. 40123 and part 193, Sec.  
193.7, based on the following findings:
    a. Summary of Why the FAA Finds that the Information Will Be 
Provided Voluntarily. The FAA finds that the information will be 
provided voluntarily. No certificate holder is required to participate 
in the VDRP. Initiation of submissions under the VDRP are indicative of 
the willingness of regulated entities to identify and correct their own 
instances of regulatory noncompliance, develop long term comprehensive 
fixes, and foster safe operating practices.
    b. Description of the Type of Information that may be Voluntarily

[[Page 54407]]

Provided Under the Program and a Summary of Why the FAA Finds that the 
Information is Safety or Security-Related.
    (1) The information that would be voluntarily submitted under a 
VDRP is described in AC 00-58, as amended, or AC 121-37, as amended. 
VDRP information submitted by a certificate holder includes:
    (a) Initial notification to the FAA of a VDRP submission.
    1. A brief description of the apparent violation, including an 
estimate of the duration of time that it remained undetected, as well 
as how and when it was discovered;
    2. Verification that noncompliance ceased after it was identified;
    3. A brief description of the immediate action taken after the 
apparent violation was identified, the immediate action taken to 
terminate the conduct that resulted in the apparent violation, and the 
person responsible for taking the immediate action;
    4. Verification that an evaluation is underway to determine if 
there are any systemic problems;
    5. Identification of the person responsible for preparing the 
comprehensive fix; and
    6. Acknowledgment that a detailed written report will be provided 
to the designated FAA official within 10 working days.
    (b) Information contained in a detailed written report submitted by 
the certificate holder to the FAA:
    1. A list of the specific FAA regulations that may have been 
violated;
    2. A description of the apparent violation, including the duration 
of time it remained undetected, as well as how and when it was 
detected;
    3. A description of the immediate action taken to terminate the 
conduct that resulted in the apparent violation, including when it was 
taken, and who was responsible for taking the action;
    4. An explanation that shows the apparent violation was 
inadvertent;
    5. Evidence that demonstrates the seriousness of the apparent 
violation and the regulated entity's analysis of that evidence;
    6. A detailed description of the proposed comprehensive fix, 
outlining the planned corrective steps, the responsibilities for 
implementing those corrective steps, and a time schedule for completion 
of the fix; and
    7. Identification of the company official responsible for 
monitoring the implementation and completion of the comprehensive fix.
    (2) Because the Federal Aviation Regulations specify the minimum 
requirements for safety, and VDRP submissions entail possible 
violations of those regulations, the FAA finds that the information is 
inherently safety related.
    c. Summary of Why the FAA Finds that the Disclosure of the 
Information Would Inhibit Persons from Voluntarily Providing that Type 
of Information.
    (1) The FAA finds that disclosure of VDRP information would inhibit 
the voluntary provision of that type of information because regulated 
entities have stated they are reluctant to voluntarily disclose 
instances of regulatory noncompliance if such submissions might be 
subject to public disclosure. A significant impediment to participation 
in the VDRP is concern over public disclosure of the information, and, 
if disclosed, the potential for it to be used for other than the system 
safety enhancement purposes for which the VDRP was created. Withholding 
such information from disclosure is consistent with the FAA's safety 
and security responsibilities because, unless the FAA can provide 
assurance that it will not be disclosed, regulated entities will be 
reluctant to participate in the program.
    (2) Although regulated entities have voluntarily disclosed 
information under the VDRP for several years, they did so after the FAA 
promised that such information would be deidentified in the Enforcement 
Information System (EIS), which is the FAA's central and national 
database of enforcement action information. The entities were reluctant 
to participate in the VDRP without this promise for fear that 
information they disclosed would be readily available to the public 
through a FOIA request for records in the EIS. So that entities 
continue to use the VDRP, the FAA has not kept the identity of persons 
reporting, or detailed information about disclosures, under that 
program in the EIS or any other central database.
    (3) The FAA finds that by virtue of designating information 
provided under the VDRP as protected under 14 CFR part 193, the 
reluctance of regulated entities to participate due to concerns about 
possible disclosure of the information will be mitigated. In addition, 
FAA will be able to retain more information about the disclosures, 
including the identity of the reporters, in an FAA database, without 
negatively impacting participation in the VDRP. Disclosures under the 
VDRP enable the FAA to become aware of many more instances of 
regulatory noncompliance than it otherwise would, and moreover, the 
VDRP permits the FAA to assure that appropriate corrective action is 
taken. If regulated entities do not participate, the FAA and the public 
will be deprived of the opportunity to make the system safety 
improvements that receipt of the information otherwise enables.
    d. Summary of Why the Receipt of that Type of Information Aids in 
Fulfilling the FAA's Safety and Security Responsibilities. The FAA 
finds that receipt of VDRP information aids in fulfilling the FAA's 
safety and security responsibilities. A primary purpose of FAA 
regulations is to assure public safety. Because the VDRP identifies and 
corrects instances of regulatory noncompliance of which the FAA may be 
otherwise unaware, the program offers significant potential for 
enhancement of public safety. Receipt of this otherwise unavailable 
information would also provide the FAA with an improved basis for 
modifying procedures, policies, and regulations to improve safety and 
efficiency.
    e. Consistencies and Inconsistencies with FAA Safety and Security 
Responsibilities.
    (1) The FAA finds that withholding VDRP information provided to the 
FAA is consistent with the FAA's safety responsibilities. The VDRP 
specifically provides that appropriate corrective action must be taken 
by the regulated entity for all instances of regulatory noncompliance 
accepted under the program. To be accepted by the FAA, apparent 
violations disclosed under the program must be inadvertent, and, where 
applicable, must not indicate a lack, or reasonable question of a lack, 
of qualification of the regulated entity. Corrective action under the 
VDRP can be accomplished by the regulated entity and verified by the 
FAA without disclosure of the protected information. If the FAA 
determines that the steps taken by the entity are not those documented 
in the written report, the submission may be excluded from the VDRP, 
and appropriate legal enforcement action may be initiated.
    (2) The FAA will release information submitted under a VDRP as 
specified in part 193 and this order. To explain the need for changes 
in FAA policies, procedures, and regulations, the FAA may disclose de-
identified (i.e., the identity of the source of the information and the 
names of the certificate holder, employees, and other persons, as well 
as any other information that could be used to ascertain the identity 
of the submitter, redacted) summary information that has been extracted 
from submissions accepted under the VDRP. The FAA may disclose de-
identified, summarized VDRP information that identifies a systemic 
problem in the aviation system, when other persons need to be advised 
of the problem so that they can take corrective

[[Page 54408]]

action. The FAA may disclose de-identified aggregate statistical 
information concerning VDRP submissions. The FAA may disclose 
independently obtained information relating to any event disclosed in a 
VDRP report, unless the FAA determines that in the case of an accepted 
VDRP submission, release of such independently obtained information 
would be inconsistent with the provisions of this order, or would 
otherwise be prohibited by public law or regulation. The FAA also may 
disclose information concerning enforcement action taken for a 
regulatory violation initially identified in a VDRP submission, when 
that submission is not accepted by the FAA, or if accepted, it is later 
excluded by the FAA, because of the regulated entity's failure to 
comply with the criteria of the VDRP.
    f. Summary of How the FAA will Distinguish Information Protected 
under Part 193 from Information the FAA Receives from Other Sources. In 
accordance with AC 00-58, all VRDP submissions must be clearly 
identified as such by the regulated entity making the submission. Any 
other information received by the FAA from the regulated entity 
concerning the content of a VDRP submission must be clearly labeled as 
follows to be eligible for protection under this designation: 
``WARNING: The Information in this Document is Protected from 
Disclosure under 49 U.S.C. 40123 and 14 CFR part 193.'' If the 
information is submitted electronically, the warning notice must be 
appropriately embedded in the electronic submission in a fashion that 
assures the visibility of the warning to any viewer.

7. Designation

    The FAA designates the information described in paragraph 5b of 
this order to be protected from disclosure in accordance with 49 U.S.C. 
40123, and 14 CFR part 193, when obtained by the FAA pursuant to an 
accepted VDRP submission.

Appendix 1.--Summary of Significant Comments Received and the FAA's 
Response

    A proposed Federal Aviation Administration (FAA) order 
designating Voluntary Disclosure Reporting Program (VDRP) 
information as protected from disclosure under Title 14 of the Code 
of Federal Regulations (14 CFR) part 193 was published in the 
Federal Register on May 25, 2006 (Federal Register, Volume 71, 
Number 101, pages 30094--30097). Comments were received from five 
commenters, including two major trade associations, and two large 
manufacturers. All commenters supported the FAA proposed action to 
protect VDRP information from disclosure under 14 CFR part 193. 
However, some commenters provided additional recommendations 
concerning the proposed FAA action. These comments and the FAA 
responses are as follows:
    1. Documents that the FAA generates in response to a voluntary 
disclosure should be exempt from public disclosure.
    a. Comment.
    (1) We agree with the proposed findings in the order. They 
describe in some detail the FAA's reasoning for the program and its 
operation. These conclusions fulfill the findings requirement of 49 
U.S.C. 40123(a), which is the statutory foundation for the VDRP.
    (2) We, however, urge that the scope of the VDRP be clarified in 
one important respect. Documents that the FAA generates in response 
to a carrier's voluntary disclosure, such as Letters of Correction, 
should be exempt from public disclosure. The self-reporting that the 
VDRP encourages will be imperiled if agency documents tied to a 
disclosure are subject to public release. For that reason, we urge 
that the final order that the FAA issues in this docket make clear 
that the agency's work product that could identify a carrier be 
designated as exempt from disclosure. The same policy should also 
apply to carrier disclosures made under AC 121-37, which contains 
the voluntary disclosure reporting program for hazardous materials.
    b. The FAA Response. The FAA concurs that the recommendation in 
the comment is consistent with the intent of this order. FAA 
generated documentation that is directly associated with an accepted 
VDRP submission has now been explicitly listed in the FAA order as 
protected from disclosure under part 193.
    2. The proposed provision that the FAA may disclose 
independently obtained information related to any event disclosed in 
a VDRP report may undermine the purpose of the VDRP.
    a. Comment. The [production certificate holder] supports the 
intent of the Proposed Order to protect information from disclosure. 
However, [the production certificate holder] has the following 
comment relating to the Proposed Order: ``The FAA may disclose 
independently obtained information relating to any event disclosed 
in a VDRP report.'' We recommend this sentence be removed from the 
Proposed Order because it could potentially undermine the purpose of 
the VDRP. For example, a certificate holder's proprietary 
information should not be disclosed outside of established processes 
under FOIA, regardless of the source of the information. In 
addition, there are circumstances under which the FAA may disclose 
information it believes was independently obtained when, in fact, it 
had already been provided to the FAA by the certificate holder. For 
example, the certificate holder could have disclosed the information 
to a local FAA office, and subsequently the same or related 
information could have been obtained by another FAA office from 
another source; in this situation, the second FAA office could 
disclose without knowing the first FAA office already had the 
information.
    b. The FAA Response. The FAA does not concur. The FAA routinely 
receives proprietary information. When such proprietary information 
is submitted to any FAA office, whether associated with a voluntary 
disclosure or otherwise, it will be protected from disclosure to the 
extent permitted by law and with associated long standing FAA 
policy, provided that the propriety claim concerning that 
information is prominently displayed in the submission, as is a 
standard procedure in such cases. With regard to the example cited 
(in which information voluntarily disclosed to a local FAA office 
might also have been obtained by another FAA office ``from another 
source''): if the other source did in fact entail information 
independently obtained by the FAA (as could occur, for example, 
through FAA surveillance activities, or through an independent FAA 
investigation, or through third party notification to the FAA), then 
the fact that such information was also contained in a voluntary 
disclosure would not ordinarily warrant the protection from release 
of that information independently obtained by the FAA. FAA policy 
prohibits acceptance of a submission under the VDRP when the FAA has 
already learned of the violation on its own. In that example, 
therefore, if the FAA had obtained this information from another 
source prior to the VDRP submission, then FAA VDRP policy would 
preclude acceptance under the VDRP. If, however, the ``other 
source'' for information received by the FAA is in fact the 
production approval holder that submitted the same information in an 
associated voluntary disclosure, or submitted it outside of a 
voluntary disclosure wherein the relevance of the information to the 
regulatory violation was not recognized by the FAA or the production 
approval holder at the time, it is incumbent upon the submitter to 
alert the FAA to that fact. To accommodate that hypothetical 
situation, the language in paragraph 6e of this order now states: 
``The FAA may disclose independently obtained information relating 
to any event disclosed in a VDRP report, unless the FAA determines 
that in the case of an accepted VDRP submission, release of such 
independently obtained information would be inconsistent with the 
provisions of this order, or would otherwise be prohibited by public 
law or regulation''. For accepted submissions under the VDRP, the 
information contained therein must be protected from disclosure in 
accordance with the provisions of this FAA order and 14 CFR part 
193.
    3. The proposed text that suggests or allows release of 
disclosure information that has been obtained from another source, 
beyond the control of the ``regulated entity,'' should be struck 
from the proposed FAA order.
    a. Comment: [The production certificate holder] has similar 
reservations as those voiced by another production certificate 
holder, who also has provided comments to this same proposed order: 
The proposed text that suggests or allows release of disclosure 
information that has been obtained from another source, beyond the 
control of the ``regulated entity,'' should be struck from the

[[Page 54409]]

proposed FAA order. To adhere to the requirements of FAA Order 
2150.3, Compliance/Enforcement Bulletin 92-2, Advisory Circular 00-
58 and 121-37, and to assure that the intent of the VDRP remains 
robust and without reservation, the production approval holder must 
step up and be accountable to ensure that immediate and long term 
corrective action plans developed to mitigate the circumstances of 
an escape are sound, effective, and implemented as pledged. The 
``regulated entity'' does not have control of information sources 
outside the chain of the disclosure proper. By the same token, the 
``regulated entity'' making the disclosure actually becomes the 
expert and information funnel for all factual matters associated 
with the disclosure. In sum, we consider that provisions for release 
of information without the counsel of the regulated entity would 
undermine the intent of the VDRP. It could allow information to be 
made public that could have negative connotation for, and actually 
hamper, ongoing investigations and airworthiness evaluations 
associated with the disclosure.
    b. The FAA response. The FAA does not concur. There are at least 
two situations in which the FAA cannot assure independently obtained 
information relating to a voluntary disclosure will not be released. 
One such situation occurs when a regulatory violation, initially 
identified in a VDRP submission, is not accepted by the FAA, or if 
accepted, is later excluded by the FAA, because of the regulated 
entity's failure to comply with the requirements of the VDRP. In 
such situations the FAA will conduct an independent investigation of 
the event, and if warranted, the resulting enforcement record based 
on the information independently obtained by the FAA is subject to 
disclosure under FOIA. No change in that policy is deemed necessary 
or appropriate. Another circumstance under which independently 
obtained information relating to an event reported under the VDRP 
may not be fully protected by the FAA occurs when an outside party 
has observed and reported a regulatory violation to the FAA. In such 
situations, the FAA must be permitted to assure the reporting party 
that the FAA has responded to their report(s) and that action has 
been taken to prevent recurrence of the violation. Such action is 
necessary to maintain public confidence. The comment expresses 
concern about the release of information from another source beyond 
the control, and outside of the chain of command, of the regulated 
entity. Clearly the FAA also has no control over the submission to 
the FAA of information related to the voluntary disclosure by a 
source outside the control or chain of command of the regulated 
entity. The FAA does not believe that such independently obtained 
information would ordinarily qualify for protection from public 
release under this order and part 193. However, in order to 
accommodate a hypothetical situation in which protection from 
release is warranted, paragraph 6e of this order now states: ``The 
FAA may disclose independently obtained information relating to any 
event disclosed in a VDRP report, unless the FAA determines that in 
the case of an accepted VDRP submission, release of such 
independently obtained information would be inconsistent with the 
provisions of this order, or would otherwise be prohibited by public 
law or regulation.''
    4. Depending upon how the proposed right of disclosure is 
interpreted and put into practice, the following proposed provision 
could have a negative impact on encouraging voluntary disclosure: 
``The FAA also may disclose any information about a disclosure 
initially submitted under the VDRP that is not accepted, or 
accepted, but later excluded because of the regulated entity's 
failure to comply with the criteria of the VDRP.''
    a. Comment. [The company] recommends that this sentence be 
removed from the Proposed Order because, depending upon how the 
proposed right of disclosure is interpreted and put into practice, 
it could potentially have a negative impact upon sound FAA policy 
encouraging voluntary disclosure of information by certificate 
holders. For example, the local FAA office has approved [the 
company's] procedure for submittal of voluntary disclosures meeting 
the intent of AC 00-58. [The company] has various data systems to 
track information drawn from different databases. Such information 
drawn from multiple sources could be included in a voluntary 
disclosure. In that circumstance, the information and the format in 
which the information is provided meets the intent of the VDRP, but 
would not necessarily strictly comply with every technical 
requirement of AC 00-58, where the VDRP criteria is contained. As 
noted above, the local FAA office has approved a [company] procedure 
for submittal of voluntary disclosures that meets the intent of AC 
00-58. However, if this sentence remains in the Proposed Order, then 
the FAA could decide to disclose information submitted in connection 
with a voluntary disclosure because of a technical deviation from 
the criteria in AC 00-58. If this occurs, certificate holders could 
potentially be disincentivized [sic] from providing the FAA with 
information because of the possibility of disclosure absent 
discussion and consensus. [The company] believes a better practice 
would be to permit local FAA offices to maintain flexibility to work 
with certificate holders relating to the format in which information 
voluntarily disclosed is received.
    b. The FAA Response. The FAA does not concur. Nothing in this 
order changes the discretionary authority of a local FAA office to 
accept or reject a voluntary disclosure. Information contained in an 
accepted voluntary disclosure will be protected in accordance with 
the provisions of this order and 14 CFR part 193, regardless of its 
format. The FAA acknowledges industry concerns regarding sensitive 
information. This FAA order will establish explicit protections 
concerning disclosure of such information when it is provided in 
conjunction with an accepted VDRP submission.

    Issued in Washington, DC, on August 17, 2006.
James J. Ballough,
Director, Flight Standards Service.

[FR Doc. E6-15257 Filed 9-14-06; 8:45 am]
BILLING CODE 4910-13-P